There’s an aspect missing thus far from the discussion of NSA’s possible bid for a cyber certification under Section 702 for primary use in the collection of attack signatures that could not be attributed to a foreign government.

The timing.

The discussion of creating a new Section 702 certificate came in the aftermath of the 6-month back and forth between DOJ and the FISA Court over NSA having collected US person data as part of its upstream collection (for more detail than appears in the timeline below, see this post). During that process, John Bates ruled parts of the program — what he deemed the intentional collection of US person data within the US — to be unconstitutional. That part of his opinion is worth citing at length, because of the way Bates argues that the inability to detach entirely domestic communications that are part of a transaction does not mean that those domestic communications were “incidentally” collected. Rather, they were “intentionally” collected.

Specifically, the government argues that NSA is not “intentionally” acquiring wholly domestic communications because the government does not intend to acquire transactions containing communications that are wholly domestic and has implemented technical means to prevent the acquisition of such transactions. See June 28 Submission at 12. This argument fails for several reasons.

NSA targets a person under Section 702 certifications by acquiring communications to, from, or about a selector used by that person. Therefore, to the extent NSA’s upstream collection devices acquire an Internet transaction containing a single, discrete communication that is to, from, or about a tasked selector, it can hardly be said that NSA’s acquisition is “unintentional.” In fact, the government has argued, that the Court has accepted, that the government intentionally acquires communications to and from a target, even when NSA reasonably — albeit mistakenly — believes that the target is located outside the United States. See Docket No. [redacted]

[T]here is nothing in the record to suggest that NSA’s technical means are malfunctioning or otherwise failing to operate as designed. Indeed, the government readily concedes that NSA will acquire a wholly domestic “about” communication if the transaction containing the communication is routed through an international Internet link being monitored by NSA or is routed through a foreign server.

[snip]

By expanding its Section 702 acquisitions to include the acquisition of Internet transactions through its upstream collection, NSA has, as a practical matter, circumvented the spirit of Section 1881a(b)(4) and (d)(1) with regard to that collection. (44-45, 48)

There are a number of ways to imagine that victim-related data and communications obtained with an attack signature might be considered “intentional” rather than “incidental,” especially given the Snowden document acknowledging that so much victim data gets collected it should be segregated from regular collection. Add to that the far greater likelihood that the NSA will unknowingly target domestic hackers — because so much of hacking involves obscuring attribution — and the likelihood upstream collection targeting hackers would “intentionally” collect domestic data is quite high.

Plus, there’s nothing in the 2011 documents released indicating the FISC knew upstream collection included cyber signatures — and related victim data — in spite of the fact that “current Certifications already allow for the tasking of these cyber signatures.” No unredacted section discussed the collection of US person data tied to the pursuit of cyberattackers that appears to have been ongoing by that point.

Similarly, the white paper officially informing Congress about 702 didn’t mention cyber signatures either. There’s nothing public to suggest it did so after the Senate rejected a Cybersecurity bill in August, 2012, either. That bill would have authorized less involvement of NSA in cybersecurity than appears to have already been going on.

With all that in mind, consider the discussions reflected in the documents released last week. The entire discussion to use FBI’s stated needs to apply as backup to apply for a cyber certificate came at the same time as NSA is trying to decide what to do with the data it illegally collected. Before getting that certificate, DOJ approved the collection of cyber signatures under other certificates. It seems likely that this collection would violate the spirit of the ruling from just the prior year.

And NSA’s assistance to FBI may have violated the prior year’s orders in another way. SSO contemplated delivering all this data directly to FBI.

Yet one of the restrictions imposed on upstream collection — voluntarily offered up by DOJ — was that no raw data from NSA’s upstream collection go to FBI (or CIA). If there was uncertainty where FBI’s targeting ended and NSA’s began, this would create a violation of prior orders.

Meanwhile, the reauthorization process had already started, and as part of that (though curiously timed to coincide with the release of DOJ’s white paper on 702 collection) Ron Wyden and Mark Udall were trying to force NSA to figure out how much US person data they were collecting. Not only did the various Inspectors General refuse to count that data (which would have, under the logic of Bates’ opinions finding that illegally collected data was only illegal if the government knew it was US person data, made the data illegal), but the Senate Intelligence Committee refused to consider reconstituting their Technical Advisory Committee which might be better able to assess whether NSA claims were correct.

Sometime in that period, just as Wyden was trying to call attention to the fact that NSA was collecting US person data via its upstream collection, NSA alerted the Intelligence Committees to further “overcollection” under upstream collection.

As I suggested here, the length of the redaction and mention of “other authorities” may reflect the involvement of another agency like FBI. One possibility, given the description of FBI collecting on cyber signatures using both PRTT and (presumably) traditional FISA in the discussions of SSO helping the FBI conduct this surveillance (note, I find it interesting though not conclusive that there is no mention of Section 215 to collect cybersecurity data), is that the initial efforts to go after these signatures in some way resulted in overcollection. If FISC interpreted victim-related data to be overcollection — as would be unsurprising under Bates’ 2011 upstream opinion — then it would explain the notice to Congress.

One more point. In this post, I noted that USA F-ReDux authorized FISC to let the government use data it had illegally collected but which FISC had authorized by imposing additional minimization procedures. It’s just a wildarseguess, but I find it plausible that this 2012 overcollection involved cyber signatures (because we know NSA was collecting it and there is reason to believe it violated Bates’ 2011 opinion), and that any victim data now gets treated under minimization procedures and therefore that any illegal data from 2012 may now, as of last week, be used.

All of which is to say that the revelation of NSA and FBI’s use of upstream collection to target hackers involves far more legal issues than commentary on the issue has made out. And these legal issues may well have been more appropriate for the government to reveal before passage of USA F-ReDux.

December 20, 2011: FBI requests access to NSA’s “access to infrastructure established by NSA for collection of foreign intelligence from U.S. telecommunications providers” to carry out FISA cyber orders (both Pen Register and content) targeting IP addresses.

May 4, 2012: DOJ informs Congress about 702 (including notice of MCT problem) in anticipation of 702 reauthorization. DOJ does not tell Congress NSA is using upstream 702 to collect on anything but email and phone identifiers.

May 4, 2012: Ron Wyden and Mark Udall request Charles McCullough to investigate how many Americans have been caught in upstream collection.

May 22, 2012: SSCI marks up FAA Reauthorization, rules Wyden amendment to reconstitute SSCI Technical Advisory Group to examine FAA out of order.

June 6, 2012: George Ellard tells Wyden a request for number of Americans caught in upstream collection is not possible and would violate the privacy of Americans.

August 24, 2012: Government submits first document for reauthorization and amendment (without mention of new certificate): “Government’s Ex Parte Submission of Reauthorization Certification and Related Procedures, Ex Parte Submission of Amended Certifications, and Request for an Order Approving Such Certification and Amended Certifications.”

September 20, 2012: FISC first approves minimization procedures allowing FBI to share of information it believes may mitigate or prevent cyber intrusions with private entities. Note, it’s possible this change also applied to NSA, but that does not appear in the unredacted discussion. If it only applies to FBI, it should pertain to PRISM production, as FBI doesn’t (or didn’t) get unminimized upstream data.

bloopie2..
quote”Along with all the legalities you note above, seems to be enough to keep the lawyers busy for years – assuming that We The People get to have our say in these things, and not just the Feds.”unquote

We the people only have an illusion that voting will satisfy each citizens review of what they are voting for is an expression of their right to vote. Unfortunately..it doesn’t matter who the fucking electorate votes for. You betcha.
.

Meanwhile, my bi-monthly expression of gratitude to emptywheel for her daily journey of posting on the net.. the truth. The unvarnished, unmitigated truth, that should reality reflect her truth upon the powers that be..would create a tsunami of revolutionary unintended consequences upon this nation UN-paralleled since the civil war. Unfortunately, we live amongst the Dumbest Country on the Planet. So yeah..

Mr. Binney testified thusly before the German inquest / truth-fest:
.
But so, in the mechanisms were––-the primary ones for collection after I was there were––-optical fiber was primarily the lead one, of course, because that’s the bulk acquisition. That’s where a bulk of data communications go today. They are on optical fibers. It’s cheaper, it’s easier to do. But they also do satellites, and microwave is still around. They got normal cable, copper cable kind of transmissions are still there. So, you have that whole complex of things, and they have ways of acquiring all of that, some more than others simply because of––-well, for example, if you look at my country alone, in the program Fairview they talked about having––-that’s one of the upstream programs that was on the Prism slides that talked about acquisition of data as it passes by on the fibers. That means these are fiber optic taps. Like the Mark Klein exposure, the fiber optic tap in San Francisco in the AT&T facility. There are on the order of 8,200 of those taps in the continental United States. So, it’s inside. So, their acquisition there is of U.S. citizens’ communications. And it’s everything. It’s not just metadata.
.
That’s why they had to build Bluffdale.
.
I mean, if you wanted to capture the metadata of the world and build all the relationships of everybody in the world, you could do that in perhaps a quarter of this room. That’s all you would need. But when you collect content, then you’re capturing bulk data. And that’s when you need large storage facilities like Utah and so on. So that’s really––-and the capability to collect that is at the rates that the Narus device would be: at 10 gigabits per second. And you could simply––-I mean, they had enough money to buy hundreds––-if not thousands––-of those devices.